Video summary
RAM serves as a critical repository for digital evidence, containing not only active programs but also files that have been executed or accessed recently. Whenever a user opens an application, downloads media, plays a game, or interacts with any software, the associated data is loaded into memory to facilitate processing. This includes decrypted versions of password-protected or encrypted files; once a file is opened and its contents are revealed in RAM, the original encryption is bypassed, leaving the sensitive data exposed in memory even if the user has since closed the application or deleted the file from the hard drive. Consequently, forensic analysts can recover this information without needing the original passwords or encryption keys, as the decrypted data persists in memory until it is overwritten or the system runs out of space.
The contents of RAM extend far beyond simple applications to include every keystroke a user makes, such as passwords, usernames, emails, and chat messages typed into buffers before being sent to websites or applications. Even when users employ private browsing modes like Incognito in Chrome or Tor Browser, which are designed to avoid writing data to the hard drive, all activity remains resident in memory until the session ends. This means that web pages, images, videos, and network traffic associated with these sessions can be reconstructed from a memory dump, effectively bypassing the privacy protections intended by private modes. Furthermore, this capability applies to live operating systems like Tails, which run entirely from RAM; although data is lost upon shutdown on such systems, a forensic copy of the RAM taken during operation would reveal all activities that occurred within that specific session.
However, the recoverability of data from RAM is not absolute and depends heavily on system resources and usage patterns. Computers with limited memory may overwrite data more quickly as new programs are loaded, reducing the window for successful recovery, whereas modern systems with 8 gigabytes or more of RAM can retain a significant amount of historical data without immediate overwriting. The operating system manages this space dynamically, cleaning up memory when necessary to load new applications, but often leaving recently used files and processes intact for some time after they are closed. Therefore, while the presence of large amounts of RAM generally increases the volume of recoverable evidence, it does not guarantee that data will remain forever; the likelihood of successful recovery is highest on standard systems where memory is abundant enough to hold deleted or closed content without rapid replacement.
In conclusion, analyzing RAM provides a powerful tool for investigators to verify user claims and uncover hidden activities that might otherwise be invisible on disk storage. By examining what programs accessed specific files, analysts can contradict suspect statements regarding their digital history, such as proving that a file was opened even if the user denies it. This method is particularly effective in malware analysis and legal proceedings where establishing the timeline of events and the actual usage of sensitive data is crucial. Ultimately, RAM acts as a transient but rich source of information that captures the real-time behavior of a computer, offering insights into browsing habits, communication content, and file interactions that persist briefly after the user has seemingly cleaned up their digital footprint.
Read the full video transcript
so a little bit more about what does ram
contain just in case you're not
convinced yet it contains programs and
files that have been executed so think
about your phone or your computer that
you've been using today
how many programs did you run how many
apps did you open right anything you did
on that computer whenever you open
something up the program is loaded into
ram the ram of your device and then if
you
downloaded a picture on instagram you
know a picture from a webpage played a
game for example all of that data and
that connection to the game server
is also loaded in ram and then the game
client does something with that data but
everything's happening in memory okay so
any programs and files that have been
executed think about files any file that
you've opened today is probably still
resident
in your ram right now even if you closed
the file and that includes
if you had an encrypted file or a
password protected file if you opened
that file up and decrypted it or used
the password to actually open it so you
could see it most likely that data is
still resident in memory right now and
we can recover it without the password
and without encryption so it's very
important for data recovery
what programs accessed what files so
this is very interesting because
especially for malware analysis ram is
used a lot for malware analysis but what
programs access what files if we have a
suspect that says that they've never
seen a particular file before
but then we have a copy of ram we can
see what programs accessed what files
so if we know that a certain program was
opened and that program was accessing a
certain file and the suspect says
they've never done this before
now we have a time that the application
was opened and then
possibly some information about the file
itself or that file's contents being
loaded into memory but now we have the
program that the suspect possibly
used to open that file right so that's
really powerful whenever you're trying
to do an interview or go to court or
something like that okay so what
programs accessed what files
where open files are were located on
disk just like i said if you open up a
file and you have to decrypt it the
decrypted version of the file is in
memory well if you open up a file
it gets loaded into memory and then if
you delete the file from the hard drive
the copy on the hard drive is deleted
but the copy in ram
still exists
if you have the program open that open
that file then that copy is still going
to be in memory
if you close the program now there's no
file on the disk because you deleted it
and you've closed the program which
means it can potentially be unloaded
from memory but
memory or
objects in ram
don't get just removed from memory
immediately usually sometimes they do
but most the time they don't which means
that if we close the program but that
file was open in memory
recently from the time that the computer
was turned on to the time that we we
arrived on scene
if that file was open
we might be able to recover the contents
from memory or we can see what program
opened that file and then we get the
full path of where the file used to be
so we know that the file was on the hard
drive at one time okay so there's a lot
of interesting things here
where open files were located even if
they were deleted
anything typed so if you type on your
keyboard basically that that keyboard
typing is going to a buffer in ram and
then being injected into
a web page or whatever it is that you're
you're typing for you know a an email a
word document chats passwords for
example if you type your password in
like we might see our password as just
dots because the program is covering it
up
but
in the backend
in ram is the actual user's password
typed out in that buffer so passwords
are very interesting because people type
their password all the time for
different websites so if you can get a
copy of ram you can potentially make
password lists based on what people have
been typing or names or things like that
so anything typed passwords usernames
emails chats just think about the things
that you type all day long all of that
is in memory
open web pages even in private mode so
private mode for most browsers attempts
to not write anything to the hard drive
so what we do instead is it just loads
everything into ram and then whenever
you're done with private mode it just
essentially erases it but it's not
completely erased right so whenever
you're doing something in private mode
all of the activities that you're doing
are still loaded into memory
if you weren't loading things into
memory private mode just wouldn't work
because you couldn't see anything on
your screen right so open web pages even
in private mode even if you're using
something like tor browser so
private mode plus
onion urls
you can potentially recover all of that
and even rebuild web pages just from
what's resident in memory okay so it's
an excellent data source if you're
interested in browsing behavior web page
contents including images and video i
already said if you're downloading
images video from the web they get
loaded into memory first or the data the
network traffic gets loaded into memory
but then your browser or whatever
program you're using
to show you the image of the video also
has to load the data into memory okay so
you can either see the network traffic
or you can see the contents that your
applications are loading
okay
and then decrypted content i've already
talked about that if you have an
encrypted file on your hard drive or
even an encrypted disk
if you decrypt that data
and interact with it some way then that
data is going to be loaded into memory
decrypted right because you have to
get access to it decrypted well where is
the computer going to store that not on
the hard drive because that wouldn't
make any sense so instead it stores it
in ram so you can potentially recover
decrypted content deleted content things
like that and then content that's no
longer on disk i've already talked about
this deleting files that have been
opened so if you open a file you close
the program and then you delete the file
that file is most likely still resident
in memory
and then content that was never on disk
like i said downloading things from the
internet um we can make special disks
called ram disks which basically act
like a hard drive but it's only in
memory live cds so for example if you're
using something like the tails secure
live cd it doesn't store anything on
disk unless you turn on persistence you
boot the computer
the system loads into memory and then
the entire operating system runs from
ram so whenever you shut off the
computer everything that happened on
that system is now lost
well if you come in and there's a system
that's running tails
if you take a copy of ram
you still get
all of the data that happened within the
last session basically okay so even if
content was never going to be written to
disk it's still in memory because the
computer used it does the computer keep
that everything in memory forever no if
a computer has a very small amount of
ram and somebody's using a lot of
programs then
the space in ram is going to be reused
faster so
the less ram somebody has
probably the less you're going to get
out of it in terms of recovery but most
computers these days have like 8 gig 16
gig or more of ram and that's plenty for
most applications right so whenever
you're starting to load programs they'll
be loaded into memory and they won't be
overwritten later after you close the
application because the operating system
can clean up that space anytime it needs
more space to load new programs the less
ram
a computer has the less likely it is
that you're going to get a lot of this
data
but on a normal system you can get quite
a bit
and then another one i've talked about a
little bit network traffic your computer
is constantly talking to
the internet if you're if you're
connected your computer is constantly
talking to the internet and all of that
network traffic is basically loaded into
ram to be processed
you